c:\DotNetZip\Zip Reduced\obj\Release\Ionic.Zip.Reduced.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Leakcloud.fun_Link_Skipper.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Leakcloud.fun_Link_Skipper.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Ionic.Zip.Reduced.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Ionic.Zip.Reduced.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
[Leakcloud.fun] Link Skipper.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
[Leakcloud.fun] Link Skipper.exe
Resource
win10v2004-20240426-en
General
-
Target
Leakcloud.fun_Link_Skipper.zip
-
Size
3.7MB
-
MD5
139b57ad667d4e50c91b09f5c98a5517
-
SHA1
23ba0adcf907d49fdf060a3729995fe67cdc4b94
-
SHA256
acc9169e89e48e648199c06809072a6802b3a49300721b885228c669b9777240
-
SHA512
47798fd026eb4256b7021a53c938a511f6d8608021ed90df5e9eac80f42bb36c2167f52d81c9b54f4c91cd596b364e881b702712740051abd5e5c13a8d98f447
-
SSDEEP
49152:uwPnmfJ4BaqTVtJf9DzZQCc9AbJucD3PAxGf6Sfl5y5FRW1JSY1CJ7t6+dK7DCMz:JvAebt9fOGfDlsJx6aGDQD+PXHwK
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/Ionic.Zip.Reduced.dll unpack001/[Leakcloud.fun] Link Skipper.exe
Files
-
Leakcloud.fun_Link_Skipper.zip.zip
-
Ionic.Zip.Reduced.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 245KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
[Leakcloud.fun] Link Skipper.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
�l��N�%)�;D!�t�;%�eN�f��äf�K����pTz�@ۭ %���|�+U��,�r�o��û�]�*BF���Fk���Rg�_�<�q���6�팏{�ݥ�.��u��w큕�~DޏnH��� ��9�.A� t��f��������������6�b�]��Şq ���}Ixtj\<7K/��.IiL\-˒@�ó�H�)s������B0 AL �Y��9��� X��4/X�w�ch�ܲ�@����nB`M��)��:&��r��'۰����Ú��w����իa�0�٤R2���a��a�[̍�|�9��Ek1��N�X���A�%BEz�/|��1�0�J�nI�4�c�ֻ�K��k����+ۄ �4���K�G�D������Q��x�+:b�a;�#1�/������7y'�"؈��,�J��8Be��ִp7V涢KO&"�@�~���C^�\>ڽ]�Y4�$zY���! ���5rJ�6�<g\Ҭ�I�h�)i�UvY��#,��W�g��rb��@u։��n��;�@���%yȳ�"E�% ��)oR�M��5�+mnI�=�Xl��&���Í,�ӱ��,�j���tB�����P�� ƓՋ̓�Wd��<��M�?o�hO`]�ߤo%��i*;`F<���p���!��E���4u������Ŭs�r���p��$��EM�����QӸ��@��% �"���U�C�(�d�9F��ը�wE�䗀R� y��>���!�wpd �+�_�xg���ì�ч�&�Զ�[���>��.���y������:t-�Q1W�O1����B������>�,��36,.�A?�������8�WZ�XzB�:��U'�V��:�+ͧ]�OM��E�=��d:?�N&ٓh�����Ӌ��Dȵ��w�S�H�$���I�Z��I�)�E5��0��#L$���x,Қ?A����:�a�<|���Z��84o�/� ��g;Z���o���� ���xb��U��s��P$��kva��J����p\���� \�����aCC�0t��A����xm �5� ��n=�M2/��������͗���hƋ�!>k07%��(&h�7Շz�����7 �R�G"$���l��.�#�������#���,���Mэ�m��D����&�F�4��g���]Ck�����l�3Y�_��Ȗ�|�<\�"eJf�7H4fż���"脢��[��Sb��&���ȝ���������7oI� i�A�� kSQ {�bX�}��O��}Jӻӌ�����0�r��-R�M�s�L��rJ��w2��s���n�wY�R��&He#�W���$�xi���p��߿��sGd�7�!��ܑD T5�Y����&L("�ʷ�YYxq&�Q������o�*H(f4�P�ҙgT��z����mo�j�E7_��T��zR~Fٵ%��$Ͱ�����96����v��d��9�y;6�`�7�/�C@+�Xi$Wa-��v$�VhF-%�z]*D]��1l�u�]�bax�WC��niBa�7����'+�>�F�z'��[��f�詡efT��L�����b�<��a4xYNIL⊩�l�ÍqA�t��M���pa`si�%? ���߱j�����l�����$rؠ=�_�r�����z������p�7�F.��mm���q�E����9b�f���VCW��&�;��Θ9i[�g<��z�L�I�3�%J;�A� ��t��V)����l�sWGp�G� M#���*����C��u` r�/3�7��9��M�/_�;���� �U�gΎ��W�%'U����� ,�(w�;�Fj�D�错����p.�XIf7���e"� �G���,^��j���D��Ŷ���4}�� �Y?���Te"�����܁�QR�1�f�}pFb�_JΜ-�ǫ�� ��^$c6��#��� �O�.�"I���u�����\���&XDI�Ų*H���w�=�3,�9Nؾ��DRO��ᣉzĹ���}�?$�[��W������=R����:>@�k���͎�t�.���1��GC���S��8n}����L�?q7G9���b�V%)p]�Z��m�����T�Nj�˰le��_Zl��7,���!�n��>bQ����?�$(P~���@:-�f�C`�<���t�Ip/\%�����ּ:����Xj�[n��U0��ې��[� ���h7�n�J�����S�%��)�֎%m��]%�?K���]�x_�þB �x�7��0�r�7�Ɯ��+)?�T��$j�z�"��L.I��o-Z�A�h�Zwk��YJ({���R$�kV��v������8 )����%�M��2^�w����w�A��/s4^edO �HT�i� MZ��:"ux|�F�ͫ�[���F����ك^�z�W�F��)����]#N��8GW��*���B�_���������~)6{�AO�'#'BrF�|�̯�"Mk������^`�=���k�o8d�6�'O��G$��Cd.���d�.}��~�r5��3�L�N��*���i2���������F���Z��V��n⚱3-4�G����d���Ƌ4~drT�T��c���]�� 2Uғy��f������������䛔ҟ��-~���s��~tB���i�<$��E�'+C�=�v�C6�ˠ���Oy�u-���4S"�j��PO=�iت��]>$䚂�� �{-��杌�P�5���& 5j%H�0ٯ�j�=�0�~���H��7\��������Y�R�o/म����T��nX���}�<d�+ZН�}��8�S�2z���e:7!�m���>ëVN{u���/�%+%J{�+E��'- 8`K'8��A��x��)��/��� G�P4� -(����z�ܖx����y�p���RY����� G-z��r��p�i��H��i��i�l:���1G�:���{Ey/���Rr�F�e�<jp�3��Al�$[�tTȃ���"��W! �>BOׅ���y9/�GJ�h��ګٞ��G9�ý�3T������^����(U�i~�t��v��i��z���94�_E�� թ'�� #��G�:��nXI��ed=�T t���%�ԥ(����!�a��� ������Y|e��cavzM"�o��%Ed 6"�k@HNj:o��������DYN���h�4(�T�I,]�tL���13� 5(��\X�'��x�cd��s����zf �I6T��?=ճ����O���6¾�*�I� l�Q��y���194�{���L�G�L�]g�*M]���
Sections
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE